Enforce the creation of App Registrations and Enterprise Applications in Entra ID to always have Owner and User Assignment.

Question

After reading this article: https://learn.microsoft.com/en-us/entra/identity-platform/howto-restrict-your-app-to-a-set-of-users#update-the-app-to-require-user-assignment

 

I want to restrict the ability to create App Registrations and Enterprise Applications in my Entra ID/Azure AD tenant unless there is an Owner and User Assignment specified.

How can I achieve this in my Azure platform without affecting the existing thousands of App Registrations and Enterprise Applications that do not contain these entries?

Any assistance would be greatly appreciated.

Answer 1

Hello and thank you for reaching out.
There’s no native enforcement at the moment that blocks app creation based on missing owners or assignment. The best option is to restrict creation, monitor continuously, and automate remediation as Entra does not provide tenant-level administrative controls to enforce Owner and User Assignment requirements during App Registration creation.
The best approach would be to first audit the existing applications-for those without owners you can use Microsoft Graph to make the required updated as indicated here-https://learn.microsoft.com/en-us/graph/api/application-post-owners?view=graph-rest-1.0&tabs=http
You can track down the Owners of these applications. Sharing this article which describes it really well- https://practical365.com/ownerless-apps/
As for application creation, when creating future applications you can consider the RBAC permissions such as assigning Application Developer role only to approved users. Additionally in the Entra Admin Center under User Settings-App registrations, set “Users can register applications” to No.